Add support for rotating docker secrets (#293)

* Add parameters for rolling updates to `docker_secret`

* Extract `remove_secrets` to its own function in `docker_secret`

* Store existing secrets in a list instead of a single secret

With this change `docker_secret` now supports the case where we store
multiple versions of a secret with the `_v123` postfix.

`absent` state implicitly handles removing these this way.

* When using `rolling_versions` don't automatically remove current secret

To make rolling updates actually work instead of failing on trying to
remove a secret that is attached to a service, use the
`versions_to_keep` parameter to remove old versions of the secret after
creating the new one. This way the secret with the new data is created
with a different name and can be attached to the service by its ID
without having to delete the previous one first which would fail if it
is already attached to a service.

* Add version numbers to newly created secrets

Attach the incremental version number to the secret name as a `_v123`
postfix where `123` is replaced with an incremental counter starting
from 1.
A label with the numeric version is also attached to the secret to ease
calculating the new version number upon change with the name
`ansible_version`.

* Return `secret_name` for docker secrets as well

* Add integration test for rolling secrets

* Update `docker_secret` documentation as per review comments

* Correctly return `docker_secret` version number as int

* Use template string for naming `docker_secrets` instead of concatenation

* Return the correct secret name on deletion failure

* Simplify `docker_secret` creation

* Add missing comma for `docker_secret` schema

* Only remove old docker secrets if `rolling_versions` is set

* Add check in `docker_secret` version parsing to handle NaNs

* Add newly created `docker_secret` to internal secret list to avoid additional deletions

* Add changelog fragment for `docker_secret` `rolling_versions` feature

* Update changelogs/fragments/270-rolling-secrets.yml

Co-authored-by: Felix Fontein <felix@fontein.de>

Co-authored-by: Felix Fontein <felix@fontein.de>

tests/integration/targets/docker_secret/tasks/test_secrets.yml

@@ -135,6 +135,82 @@
       that:
         - output.failed
 
+# Rolling update
+
+  - name: Create rolling secret
+    docker_secret:
+      name: rolling_password
+      data: opensesame!
+      rolling_versions: true
+      state: present
+    register: original_output
+
+  - name: Create variable secret_id
+    set_fact:
+      secret_id: "{{ original_output.secret_id }}"
+
+  - name: Inspect secret
+    command: "docker secret inspect {{ secret_id }}"
+    register: inspect
+    ignore_errors: yes
+
+  - debug: var=inspect
+
+  - name: assert secret creation succeeded
+    assert:
+      that:
+         - "'rolling_password' in inspect.stdout"
+         - "'ansible_key' in inspect.stdout"
+         - "'ansible_version' in inspect.stdout"
+         - original_output.secret_name == 'rolling_password_v1'
+    when: inspect is not failed
+  - assert:
+      that:
+         - "'is too new. Maximum supported API version is' in inspect.stderr"
+    when: inspect is failed
+
+  - name: Create secret again
+    docker_secret:
+      name: rolling_password
+      data: newpassword!
+      rolling_versions: true
+      state: present
+    register: new_output
+
+  - name: assert that new version is created
+    assert:
+      that:
+         - new_output.changed
+         - new_output.secret_id != original_output.secret_id
+         - new_output.secret_name != original_output.secret_name
+         - new_output.secret_name == 'rolling_password_v2'
+
+  - name: Remove rolling secrets
+    docker_secret:
+      name: rolling_password
+      rolling_versions: true
+      state: absent
+
+  - name: Check that secret is removed
+    command: "docker secret inspect {{ original_output.secret_id }}"
+    register: output
+    ignore_errors: yes
+
+  - name: assert secret was removed
+    assert:
+      that:
+        - output.failed
+
+  - name: Check that secret is removed
+    command: "docker secret inspect {{ new_output.secret_id }}"
+    register: output
+    ignore_errors: yes
+
+  - name: assert secret was removed
+    assert:
+      that:
+        - output.failed
+
   always:
   - name: Remove Swarm cluster
     docker_swarm:

tests/integration/targets/docker_swarm_service/tasks/tests/secrets.yml

@@ -5,6 +5,7 @@
     service_name: "{{ name_prefix ~ '-secrets' }}"
     secret_name_1: "{{ name_prefix ~ '-secret-1' }}"
     secret_name_2: "{{ name_prefix ~ '-secret-2' }}"
+    secret_name_3: "{{ name_prefix ~ '-secret-3' }}"
 
 - name: Registering container name
   set_fact:
@@ -24,6 +25,14 @@
   register: "secret_result_2"
   when: docker_api_version is version('1.25', '>=') and docker_py_version is version('2.1.0', '>=')
 
+- docker_secret:
+    name: "{{ secret_name_3 }}"
+    data: "secret3"
+    state: "present"
+    rolling_versions: true
+  register: "secret_result_3"
+  when: docker_api_version is version('1.25', '>=') and docker_py_version is version('2.1.0', '>=')
+
 ####################################################################
 ## secrets #########################################################
 ####################################################################
@@ -131,6 +140,40 @@
   register: secrets_8
   ignore_errors: yes
 
+- name: rolling secrets
+  docker_swarm_service:
+    name: "{{ service_name }}"
+    image: "{{ docker_test_image_alpine }}"
+    resolve_image: no
+    command: '/bin/sh -v -c "sleep 10m"'
+    secrets:
+      - secret_name: "{{ secret_name_3 }}_v1"
+        filename: "/run/secrets/{{ secret_name_3 }}.txt"
+  register: secrets_9
+  ignore_errors: yes
+
+- name: update rolling secret
+  docker_secret:
+    name: "{{ secret_name_3 }}"
+    data: "newsecret3"
+    state: "present"
+    rolling_versions: true
+  register: secrets_10
+  when: docker_api_version is version('1.25', '>=') and docker_py_version is version('2.1.0', '>=')
+  ignore_errors: yes
+
+- name: rolling secrets service update
+  docker_swarm_service:
+    name: "{{ service_name }}"
+    image: "{{ docker_test_image_alpine }}"
+    resolve_image: no
+    command: '/bin/sh -v -c "sleep 10m"'
+    secrets:
+      - secret_name: "{{ secret_name_3 }}_v2"
+        filename: "/run/secrets/{{ secret_name_3 }}.txt"
+  register: secrets_11
+  ignore_errors: yes
+
 - name: cleanup
   docker_swarm_service:
     name: "{{ service_name }}"
@@ -147,6 +190,9 @@
       - secrets_6 is not changed
       - secrets_7 is changed
       - secrets_8 is not changed
+      - secrets_9 is changed
+      - secrets_10 is not failed
+      - secrets_11 is changed
   when: docker_api_version is version('1.25', '>=') and docker_py_version is version('2.4.0', '>=')
 - assert:
     that:
@@ -405,6 +451,7 @@
   loop:
     - "{{ secret_name_1 }}"
     - "{{ secret_name_2 }}"
+    - "{{ secret_name_3 }}"
   loop_control:
     loop_var: secret_name
   ignore_errors: yes